GeezerVison

Reviewed 2026-09-25: workload-specific canonical outcomes (success/failure/denied), handles the AAD UserLoginFailed ResultStatus:Success quirk via RecordType 15 + LogonError; 4 new low-sev awareness rules key on actionResult=success + Exchange ops that are ingested (not in the drop list); forwarding rules key on the new log.o365* markers (with structured-Parameter fallback for older filters). DEPENDENCY: writes failure where v11 wrote failed - the EventProcessor feeds (TI) plugin skips only denied/blocked/failed, so companion EventProcessor #19 should land first to avoid a Known-Malicious-IP false-positive window on failed O365 sign-ins. 122 fabricated + 328 real records pass in the author's playground.